You don't need complex sandboxing tools to safely run AI agents on your machine. There's a much simpler solution.
After losing a whole project folder to an overzealous AI agent, I found that the simplest solution is also the best: give the agent its own drive letter.
How It Works
Here's what I do:
- Create a dedicated folder for the AI agent's work
- Map that folder to a drive letter on Windows
- Point the agent only at that drive
The agent sees only that drive. It can't touch anything outside. OS-level isolation, no VM overhead.
Two Tools, Two Scenarios
I use two tools depending on where the files live:
Local Files: ScsSubst
If the agent works with local files, I use ScsSubst to map the local folder to a drive letter.
It's lightweight, portable, and one-time purchase. Way cheaper than dealing with accidentally deleted files.
Cloud / WebDAV Files: ScsDrive
If the data lives in the cloud (WebDAV, NAS, etc.), I use ScsDrive to mount the cloud folder as a drive.
Same isolation, no local safety concerns. The agent works with cloud files but still can't escape the drive.
Why This Is Easy
I've tried other approaches:
- VMs — slow, heavy, annoying to share files
- Containers — requires Docker setup, still complex
- Restricted user accounts — clunky, doesn't fully isolate
Drive letter isolation is:
- Instant — map a folder and you're done
- Lightweight — no VM overhead
- Simple — the agent sees a regular drive, no special config
- Cheap — way cheaper than backup software
Give It a Try
Next time you run an AI agent, don't give it your whole filesystem. Create a dedicated folder, map it to a drive, and let the agent work inside that drive only.
Both are one-time purchases, way cheaper than dealing with accidentally deleted files.
Top comments (0)